ramnit | 372182649f8804b3715be4acb1c46a26b961efd63b6845cc7df55c3ed511fb3e

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 07:37

Target
3ec6e72223b4c9087943e65c5c336340_NeikiAnalytics.dll
Size 38KB
Sample240604-jft2bahf7w
SHA256 372182649f8804b3715be4acb1c46a26b961efd63b6845cc7df55c3ed511fb3e
MD5 3ec6e72223b4c9087943e65c5c336340
SHA1 034a21c92022499980363bfe54d45887b55aa8d1
SHA512 a43803d98d248b054f37fc83f1cc09d63eb227d1b27cffc931923989f32f8ce8b1af49564ba60dfaf9d193dd1b3d127e1c1f6bf9466a2a706d8f65fd27d23810
SSDEEP 768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7xIXU76m2s92VV:WD8w22laSR0V+3CJrV8XczJ9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	1520	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1520	2980	rundll32.exe	85
PID 2980 wrote to memory of 1520	2980	rundll32.exe	85
PID 2980 wrote to memory of 1520	2980	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec6e72223b4c9087943e65c5c336340_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec6e72223b4c9087943e65c5c336340_NeikiAnalytics.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 604
    3⤵
    - Program crash
    PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1520 -ip 1520
1⤵
PID:5068

memory/1520-0-0x0000000010000000-0x000000001000D000-memory.dmp

Download

memory/1520-2-0x0000000010000000-0x000000001000D000-memory.dmp

Download